806-regulations-eu-data-act
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to analyze external Java code, API contracts, DTOs, and Kafka schema registries, which presents a surface for indirect prompt injection if those files contain adversarial instructions.
- Ingestion points: System codebases, metadata catalogs, API documentation, Kafka contracts, and cloud provider agreements (identified in
SKILL.mdworkflow). - Boundary markers: Absent; the skill does not define specific delimiters to isolate external file content from instructions.
- Capability inventory: File system read access and text generation for report creation; no direct command execution or non-whitelisted network tools are enabled.
- Sanitization: Absent; the skill relies on the agent's internal safety filters and the architectural context to process technical artifacts.
- [SAFE]: All external URLs point to the official European Union Law portal (
eur-lex.europa.eu), which is a trusted government domain. The skill instructions focus on regulatory compliance and best practices for data governance without attempting to override agent safety protocols. No signs of obfuscation, persistence, or credential harvesting were found.
Audit Metadata